Hackers Exploit FastJson RCE Zero-Day to Target US Companies

What Happened

According to a report from BleepingComputer, attackers are actively exploiting a zero-day vulnerability in FastJson, a widely used open-source Java library for parsing and serializing JSON data. The flaw reportedly allows remote code execution without requiring user interaction or elevated privileges, and is being used in ongoing attacks against companies in the United States. Technical details such as a CVE identifier, affected version ranges, or the specific exploitation vector have not been confirmed at this time.

Why It Matters

FastJson is embedded in a large number of Java-based backend services, particularly in enterprise and financial applications, often as a transitive dependency that application owners may not be directly aware of. A pre-authentication RCE flaw in a library this pervasive raises the risk of widespread compromise, especially given FastJson's history of prior deserialization vulnerabilities that were also exploited at scale. Organizations running Java applications should treat this as a potentially high-impact supply-chain exposure until more details emerge.

What Defenders Should Do Now

• Inventory applications and services for FastJson usage, including indirect/transitive dependencies pulled in via other libraries or frameworks.
• Monitor for anomalous outbound connections from Java application servers, which can indicate exploitation of deserialization-style RCE bugs.
• Watch for unexpected child processes spawned by Java runtimes (e.g., java spawning shells or scripting interpreters) as a general detection angle for JVM RCE exploitation.
• Review web application firewall and reverse proxy logs for unusual JSON payloads or requests to endpoints known to parse untrusted JSON input.
• Follow vendor and FastJson project advisories closely for patch or mitigation guidance as it becomes available.

Developing Story

This is early-stage, developing intelligence with limited technical detail disclosed publicly so far. No CVE has been assigned or confirmed in current reporting, and attribution, affected versions, and full scope remain unclear. Defenders should monitor for updates as more information is released. Read the original report at BleepingComputer.